Turborepo

Turborepo adds an experimental setup command surface with bounded, checksum-verifying downloads and atomic lock writes for managed tool installation. Also includes fixes for npm patches in pruned workspaces, symlinked AGENTS.md preservation, and a codemod that generated duplicate package names.

SDKROOT is now passed through to repository tasks, and Vercel OIDC token rotation in .env.local no longer busts cache inputs. Also refreshed the with-vite-module-federation example.

Added task tags with configuration inheritance, exposed task and package tags in the query command, and enabled filtering query tasks and packages by tags from the CLI. Also fixed Yarn patch resolutions being dropped with npm protocol selectors in prune, normalized task inputs for affected detection and hashing, made query commands infer single-package mode, and completed task query metadata for non-script entrypoints.

Affected detection now respects negated global dependencies, secondary go.work files Go only reads for workspace members are no longer rejected, and remote cache disables itself after unrecoverable forbidden responses. Also shares concurrent remote-cache token recovery, batches dry-run cache existence checks, and moves the version into turbo query JSON output.

Turborepo now ignores gitignored files in boundaries, stabilizes boundaries tag order in prune, and normalizes affected task input globs. The release is otherwise dominated by internal refactors extracting task filtering, task access, and watcher logic into dedicated crates.